Locks and Key Control: Cylinders, Master Keys, Key Audits

Mechanical keys are the oldest access credential in most organisations, and usually the least governed: nobody can say how many exist, who holds them, or which doors a lost master key opens. Electronic access control gets the audits, the logs and the joiner-mover-leaver integration, while the cylinder on the comms room, the plant room or the cash office still runs on a key that was cut years ago. This guide covers how to choose cylinders using the published grading schemes, how to design and protect master key systems, and how to run a key control programme with issue records, musters, lost-key rules and audits. It is written for security managers, facilities leads and converged security teams who have inherited locks along with the rest of the physical estate. It is defensive throughout: it describes attack classes so you can specify against them, not how to perform them.

Source note: standards and vendor facts on this page are taken from the official documents listed under Standards and references, checked in November 2026. Grade choices per door tier, lost key thresholds, the implementation plan and checklist are NHI Mgmt Group recommendations. Confirm against the official text before relying on it.

Key takeaways

A key is a credential without a log. Treat every key like a shared password that cannot be revoked remotely: issue the minimum, record every holder and plan for loss.
Grade the cylinder to the door's risk. EN 1303 key security and attack resistance grades and ANSI/BHMA A156.30 levels give you a written specification instead of a sales claim.
Master keying trades security for convenience. NPSA states master systems are intrinsically less secure and are not recommended where the highest security is required; protect the grand master and the pinning records as crown jewels.
Restricted key profiles stop casual copying, not determined attackers. Pair them with custody agreements, a ban on sharing key images and regular reconciliation against staff and contractor lists.
Muster and reconcile on a schedule. NPSA suggests random key musters every 6 to 12 months; every issued key should have an approval, a log entry and a recorded return.

Why mechanical keys are an identity problem

NIST SP 800-53 Rev. 5 control PE-3 Physical Access Control includes three requirements that most organisations meet for badges and miss for keys: secure keys, combinations and other physical access devices; inventory them at a defined frequency; and change combinations and keys when keys are lost, combinations are compromised, or when individuals holding them are transferred or terminated. A badge can be disabled in seconds. A key keeps working until the cylinder is changed, which is why loss and leaver handling drive most of the cost of a key system.

The WaterISAC fact sheet on keys and locks lists the modern failure modes: unauthorised duplication, lost keys and uncontrolled access, with newer threats including keys reproduced by 3D printing from photographs or scans, lock bumping, and insider misuse or duplication. Remote and lightly staffed sites are most exposed because nobody notices a door opened with a legitimate key.

Identity parallel: a grand master key is a standing privileged credential with no expiry, no MFA and no session record. Apply the same thinking you use for break-glass accounts in the Privileged Access Management Guide.
Lifecycle parallel: key issue and return belong in the same leaver workflow that disables the badge and the directory account. See the Joiner-Mover-Leaver Guide.
Insider parallel: duplication and lending are insider behaviours. See the Insider Threat Programme Guide.

Lock and key system types

The broader site model of deter, detect, delay and respond is covered in the Physical Security Guide for Security Teams. Locks sit in the delay layer, and the type of key system determines how much of the risk you can manage administratively.

System type	How it works	Strength	Main risk	Typical fit
Standard key per lock	Each cylinder has its own key, no hierarchy	Loss affects one door	Unmanageable at scale; keys copied at any kiosk	Small sites, store cupboards
Master key system	Individual keys plus sub master and grand master keys that open groups of locks	Fewer keys carried; reflects organisation structure	Loss of a master or grand master compromises every cylinder below it	Offices, campuses, multi-tenant buildings
Restricted keyway	Patented or registered key profile; blanks supplied only to authorised dealers against an authorisation	Stops casual duplication	Protection lasts only while the patent or registration is valid and enforced	Any managed estate
High security cylinder	Restricted profile plus tested resistance to manipulation, drilling and forcing	Specified against attack classes	Cost; undermined by weak doors, frames or furniture	Comms rooms, plant, cash, secure stores
Electromechanical cylinder	Mechanical cylinder with an electronic credential in the key, often with audit trail and scheduling	Lost keys removed from the system without recoring; access logs	Control software, batteries and programming station become assets to protect	Remote sites, utilities, high churn areas

WaterISAC recommends a hybrid view: keep mechanical keys where they provide reliable access during power or network outages, and add card readers or electronic keys where you need audit trails, rapid revocation and role-based access. Electronic options carry their own cyber, power and failure risks, so treat the programming station as part of the estate covered by the Physical Access Control Systems Security Guide.

Specifying cylinders with published grades

Write the lock specification against a standard, not a product brochure. Two schemes dominate.

EN 1303 (Europe and UK)

EN 1303 classifies cylinders with an eight-digit code: category of use, durability, door mass, fire resistance, safety, corrosion and temperature, key-related security, and attack resistance. The last two digits are the security ones.

Digit 7: key security grade	Minimum effective differs	Minimum movable elements	Key coding may disclose combination
1	100	2	Yes
2	300	3	Yes
3	15,000	5	No
4	30,000	5	No
5	30,000	6	No
6	100,000	6	No

Digit 8, attack resistance, runs from grade 0 (no requirement) to grade 2. Grade 1 requires 3 minutes net drilling time, 30 chisel blows and 20 defined twists; grade 2 raises this to 5 minutes, 40 blows and 30 twists, with a 15 kN extraction load at both grades and plug torque resistance of 20 Nm and 30 Nm respectively. Our recommendation (NHI Mgmt Group): for any door protecting systems or regulated data, specify key security grade 4 or higher (so the key code cannot reveal the combination) and attack resistance grade 1 or 2.

ANSI/BHMA A156.30 and UL 437 (North America)

ANSI/BHMA A156.30 sets security performance requirements for mechanical and electrified high security cylinders, including their keys or electronic credentials, detainers and cams. Manufacturers declare a security level, and the cylinder must pass every test for that level. Levels are separate from grades: grade listing comes from testing under ANSI/BHMA A156.5, an assembly is rated at the lowest grade of its components, and a lockset fitted with a cylinder that has no grade listing is treated as ungraded. BHMA notes the tests are laboratory tests, so installation and maintenance still decide field performance. UL 437 is the other North American high security cylinder listing referenced in utility guidance such as the WaterISAC fact sheet.

The weakest component sets the rating

NPSA makes the same point for doorsets: a lock fitted to security furniture takes the class of the lower-rated product. Before paying for a high security cylinder, check the door leaf, frame, hinges and handles, and check whether the room can be reached over a shared false ceiling or under a raised floor.

Designing and protecting a master key system

NPSA describes master keying as a form of access control that is intrinsically less secure than individual keying and not recommended where the highest security is required. If you use one, design it deliberately.

Start from the access model: map zones, roles and who genuinely needs cross-zone access, the way you would design RBAC. NPSA's example is individual keys for staff, floor-level sub masters for managers and a single grand master for the most senior holder.
Keep the hierarchy shallow: each extra level multiplies the number of doors a single loss exposes.
Exclude high security rooms: comms rooms, secure stores and plant rooms should sit outside the master suite, on their own restricted or electromechanical cylinders.
Have it designed by a professional: NPSA advises using a professional locksmith or security practitioner for the key system design.
Secure the pinning records: manufacturers may hold a pinning list (the key pattern record) for your organisation. Agree in writing how it is stored, who can request keys against it, and how requests are authenticated. Losing control of the records is equivalent to losing the grand master.
Control the supply chain: buy from the manufacturer's official dealer, and where risk warrants, ship keys and cylinders by separate routes in tamper-evident packaging with a trusted courier, then store them securely on receipt.
Stage new builds: NPSA advises using low-level construction cylinders until you control the building, then installing the permanent system, starting with external doors.

Running a key control programme

The WaterISAC eight-step programme and the NPSA guidance converge on the same operating model. The table below turns it into roles and records.

Element	What good looks like	Evidence to keep
Policy and authority	Named key control authority; defined approvers per key level; no verbal or informal approvals	Approved policy; approver list
Request and issue	Written or electronic request for every key; least privilege; time-limited issue for contractors	Request and approval record per key
Issue log	Central register of key number, holder, date issued, approver, date returned	Register extract
Custody agreement	Holder acknowledges no lending, no duplication, no posting or sending key images, report loss immediately	Signed agreement
Labelling	Keys stamped with a unique identifier, never a door or facility name	Key schedule held separately
Storage	Spare and master keys in locked key cabinets or electronic key management systems, never desks, drawers or vehicles; cabinet access list revoked on role change	Cabinet access list; cabinet logs
Musters and audits	Random musters every 6 to 12 months (NPSA); reconcile issued keys against staff, contractor, vendor and seasonal rosters	Muster results; exceptions closed
Lost or stolen keys	Immediate reporting at any hour; written rekey criteria; incident record; spare cylinder stock ready	Incident reports; rekey records
Disposal	Retired keys and cylinders destroyed securely (NPSA refers to its Secure Destruction of Sensitive Items Standard)	Destruction certificate

NPSA adds two rules worth writing into policy: high security keys must never leave the building they protect, and unissued keys stay under the security officer's control, in a key cabinet where the risk warrants. Any emergency key box should be an approved device, because it concentrates keys in one place outside your normal custody.

Lost key decisions

Decide rekey thresholds in advance so the incident is a procedure, not a debate.

Individual key, restricted profile, no identifying label: record, monitor the door, rekey at the next scheduled change unless other indicators appear.
Individual key for a sensitive room, or key lost with a badge or address: rekey that cylinder now.
Sub master lost: rekey the group; review whether that sub master level is needed at all.
Grand master lost or pinning records exposed: treat as a site-wide compromise; raise guarding or monitoring on critical doors until recoring is complete.
Electromechanical key lost: remove the key from the system, which NPSA describes as usually a simple reprogramming task, and confirm the change reached offline cylinders.

Attack classes to specify against

CAPEC catalogues lock attacks under CAPEC-390 Bypassing Physical Security and CAPEC-391 Bypassing Physical Locks, with children including CAPEC-392 Lock Bumping and CAPEC-393 Lock Picking. You do not need to know how these are done to defend against them; you need cylinders tested against them and processes that remove the easier routes.

Attack class	Defensive control	How to verify
Unauthorised duplication (kiosk copies, 3D printed keys from photos)	Restricted or patented profile; dealer authorisation; ban on sharing key images; staff awareness	Confirm patent or registration status periodically; test dealer authorisation process
Manipulation (picking, bumping, impressioning)	Cylinders at EN 1303 key security grade 4 or above, or A156.30 tested levels; anti-bump features where the standard applies	Certification marks and test reports on file
Forced attack (drilling, extraction, snapping, twisting)	EN 1303 attack resistance grade 1 or 2; tested security furniture; reinforced doorsets	Doorset and hardware classification records
Bypass of the door rather than the lock	Check ceilings, raised floors, glazing, hinges and frames before upgrading the cylinder	Site survey using the Physical Security Site Assessment Checklist
Insider misuse and lending	Few master keys; strict issue; musters; door alarms on sensitive rooms	Muster exceptions; door-held and forced alarms

Authorised testing of locks and doors belongs in a scoped engagement with written permission. See the Social Engineering and Physical Penetration Testing Guide.

How to implement

Inventory (weeks 1 to 4): list every cylinder by location, key system and grade; list every key and holder you can find. Expect gaps: record unknown keys as lost.
Classify doors: assign each door a risk tier (public, internal, restricted, high security) and the target cylinder specification per tier.
Quick wins: move spare and master keys into a locked cabinet, recover keys from leavers and contractors, relabel keys that carry door names.
Write the policy: authority, approval levels, custody agreement, loss procedure and rekey thresholds.
Pilot: recore one building or zone to the new specification and key hierarchy; run a muster after 30 days to test the register.
Roll out by tier: high security rooms first, then external doors, then internal doors. Keep the old cylinders and keys under control until each zone is signed off, so you can revert a door if the new hardware fails or blocks an escape route.
Integrate: add key return to the leaver checklist and key holdings to access reviews; consider electromechanical cylinders where churn or remoteness makes mechanical rekeying expensive.

Always check fire and egress requirements with the responsible person before changing hardware on escape routes; EN 1303 digit 4 shows whether a cylinder is suitable for fire or smoke resisting door assemblies.

Small and large organisations

Small sites: a restricted profile, a spreadsheet register, one locked key cabinet and an annual muster cover most of the risk. Avoid a master system unless the number of doors makes it necessary.
Large or multi-site estates: a central key control authority, electronic key cabinets with logs, electromechanical cylinders for remote and high churn sites, and key holdings fed into the identity governance review cycle.

Detection and measurement

Monitor: door-forced and door-held alarms on keyed sensitive doors, electronic key cabinet logs, electromechanical cylinder audit trails, and lost key reports. Send cabinet and cylinder logs to the same place as badge logs so investigators see one picture. See the Intrusion Alarm Systems Security Guide.
Key reconciliation rate: percentage of issued keys confirmed at the last muster (target 100 percent, exceptions closed within 30 days).
Leaver key recovery: percentage of leavers with all keys returned on the last day.
Master key count: number of master and grand master keys issued, trending down.
Lost key response time: hours from report to rekey or documented risk decision.
Specification coverage: percentage of restricted and high security doors fitted with cylinders meeting the tier specification.

Framework mapping

Framework	Reference	What it asks of key control
NIST SP 800-53 Rev. 5	PE-3 Physical Access Control	Secure keys and combinations, inventory them, change them on loss or holder transfer or termination
NIST SP 800-53 Rev. 5	PE-2 Physical Access Authorizations	Approved list of who may access, which includes key holders
NIST SP 800-53 Rev. 5	PE-3(4) Lockable Casings; PE-6 Monitoring Physical Access	Locked enclosures for components; monitoring of physical access events
NIST CSF 2.0	PR.AA-06	Physical access to assets is managed, monitored and enforced commensurate with risk
ISO/IEC 27001:2022 Annex A	7.2 Physical entry; 7.3 Securing offices, rooms and facilities; 5.18 Access rights	Entry controls, secured rooms and reviewed access rights, including keys
MITRE CAPEC	CAPEC-391, CAPEC-392, CAPEC-393	Attack patterns that cylinder specification and key control address

For the wider PE control family, see the NIST SP 800-53 PE Physical and Environmental Protection guide.

Common failure patterns

No register for keys issued before the current team: keys from former staff, contractors and previous tenants still open doors. Rekey on takeover of any building.
Keys labelled with door names: a lost bunch becomes a map. Use unique identifiers and keep the schedule elsewhere.
Master keys as a perk: grand masters handed out for convenience to managers and facilities contractors, so one loss compromises the site.
High security cylinder in a weak door: the rating is set by the weakest component, and a shared ceiling void bypasses both.
Pinning records nobody controls: a locksmith or manufacturer will cut keys on request from anyone who sounds plausible because no authentication was agreed.
Electromechanical systems left unmanaged: the programming station sits on an unpatched desktop with a shared login, turning a lock upgrade into a cyber exposure.

Practitioner checklist

Name a key control authority and approvers for each key level.
Build a register of every cylinder, key and holder; record unknown keys as lost.
Set a cylinder specification per door tier using EN 1303 or ANSI/BHMA A156.30.
Keep high security rooms out of the master key suite.
Agree with the manufacturer how pinning records are protected and how key orders are authenticated.
Store spare and master keys in a controlled cabinet with a reviewed access list.
Require signed custody agreements that ban lending, copying and sharing key images.
Write lost key rekey thresholds and keep spare cylinders available.
Run random musters every 6 to 12 months and reconcile against HR and contractor lists.
Add key return to the leaver workflow and key holdings to access reviews.

Locks and Key Control: how to grade cylinders and run a key programme